Blockchain forensics, OSINT, and expert evidence under one engagement
XELTRUS combines blockchain forensics, open-source intelligence, and cyber-incident analysis to reconstruct what happened and who was involved. Each engagement is matter-specific and opens with a written scope. Where legal action is warranted, it is handled by independent, licensed counsel.
How we work, end-to-end
The operational pillars of every XELTRUS engagement. Each pillar is delivered under one engagement architecture, against one evidentiary record, with one written viability assessment opening the work.
Forensic Chain Analysis & Asset Tracing
Full on-chain reconstruction across Bitcoin, Ethereum, and major chains. Identification of counterparties, custodians, exchanges, and fiat off-ramps. Documented under chain-of-custody protocols; admissibility is decided by the court in each matter.
Learn moreAsset Tracing & Civil-Action Support
Where an investigation supports a civil claim, our tracing and documented evidence are handed to independently retained counsel, who assess and pursue any available civil action. XELTRUS does not litigate and does not guarantee any outcome.
Learn moreExpert Evidence & Litigation Support
Documented, reproducible forensic reports prepared to the standard litigation requires, integrated with independently retained counsel — matter-specific, with the engagement letter signed directly between client and counsel.
Learn moreWritten viability assessment first — engagement second
Every prospective matter is evaluated through a written, fact-specific viability assessment before any meaningful resources are committed. The assessment identifies which federal mechanisms are applicable, what the on-chain and off-chain evidentiary posture looks like, and whether the matter meets the qualification threshold. Only matters that pass viability proceed to engagement.
Coverage that maps to where digital assets actually move
Investigative posture is shaped by the asset class and the chains involved. Our forensic posture is calibrated for each layer of the digital-asset ecosystem in which loss occurs.
Bitcoin & Bitcoin-derived chains
UTXO-graph reconstruction, common-input clustering, peel-chain detection, CoinJoin participation analysis, and Bitcoin-derived chain coverage. Forensic posture aligned with the longer-running attribution datasets and the deeper precedent-base for Bitcoin-related federal proceedings.
Ethereum & EVM ecosystem
Account-graph reconstruction across Ethereum and EVM-compatible chains, ERC-20 and ERC-721 transfer tracing, smart-contract interaction analysis, and bridge-event correlation. Includes ERC-20 token-offering reconstruction, fake-DEX clone analysis, and reconstruction of misappropriations executed via staking, restaking, or validator-routed paths.
Cross-chain & bridges
Reconstruction across canonical and third-party bridges, wrapped-asset pairs, and cross-chain liquidity venues. Reconciliation of bridge events under a unified asset identity, so the proceeds path remains coherent when assets move between chains during the misappropriation.
One engagement, one evidentiary record
The recurring failure mode in these matters is fragmentation: the forensic provider, the counsel, and the cross-border counsel each work from a different version of the underlying record. We treat that fragmentation as the primary risk to manage. The engagement architecture is designed so the forensic record, the legal strategy, and the counsel work-product all feed from — and back into — a single, versioned evidentiary record.
How a matter moves from intake to disposition
Each engagement passes through sequential phases with explicit checkpoints, so the matter can be paused, re-scoped, or terminated cleanly at the points where doing so protects the claimant.
Intake & confidential assessment
Confidential intake under written protocol. Initial fact-pattern review, asset-class scoping, jurisdictional posture, and identification of the candidate federal mechanisms. The intake phase ends with the production of a written viability opinion that the claimant can review with independent counsel.
Forensic reconstruction & viability
Where intake clears the threshold, the matter proceeds to forensic reconstruction: on-chain trail, off-chain corroboration, attribution analysis, and asset-state-at-intake report. The reconstruction is delivered under chain-of-custody and is the foundation document for the viability decision.
Engagement & disposition
Where viability supports proceeding, the engagement is structured under written agreement and the civil action is documented against the forensic record. The engagement runs through to disposition with integrated forensic, procedural, and counsel work-product on the same versioned record.
The honest list of what is outside our practice
We do not pursue matters that fail the viability threshold. We do not engage on contingency without a written viability opinion. We do not solicit prospective clients through unsolicited outreach. We do not hold private keys, seed phrases, or wallet-access material for clients. We do not publicize engagements or claimants. We do not represent that any matter will be successful, and we say so directly at intake rather than after a year of work.
Different claimants, one intake protocol
Matters reach us through distinct entry points. Each profile is handled under the same written intake protocol, with the engagement structure adapted to the client’s posture.
Individual claimants
Individuals affected by exchange-exit insolvencies, pig-butchering syndicates, false-trading platforms, fraudulent staking or validator schemes, token-offering misappropriation, or cross-border Bitcoin theft whose loss-shape supports a viable federal-law posture. Intake is direct and the engagement is structured matter-specifically around the individual case.
Client cohorts
Mass-claimant matters affecting hundreds or thousands of people affected by a single scheme. The cohort’s representation structure is established before counsel is engaged, so the chain of authority is unambiguous from the outset and the cohort’s coherence is preserved through disposition.
Counsel & professional advisors
Law firms, client advocates, and professional advisors evaluating the federal-law posture of a matter on behalf of their own client. We work as the forensic and coordination layer behind the existing counsel relationship, under a parallel engagement structure that preserves it.
Request a viability assessment
If the matter you are considering involves Bitcoin theft, cryptocurrency misappropriation, or NFT fraud — whether you are directly affected, represent a group of affected parties, or are counsel evaluating a matter — reach out under our written intake protocol. All initial inquiries are reviewed by intake staff bound to confidentiality.